subscription-recovery
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, untrusted sources, creating an attack surface for instructions embedded in third-party content.
- Ingestion points: User-provided bank statements (PDF, CSV, or screenshots) in Phase 1b and merchant-specific billing pages accessed via browser interaction tools in Phase 3.
- Boundary markers: The skill contains a strict 'IRON LAW' necessitating explicit user naming of services and a 'Boundaries' section forbidding the storage of credentials or acting on ambiguous approval.
- Capability inventory: Utilizes the
mcp__claude-in-chrome__*toolset for browser navigation and interaction with merchant sites (SKILL.md). - Sanitization: The skill relies on natural language instructions for the agent to maintain boundaries; no automated sanitization or structured validation of ingested text is specified.
Audit Metadata